protections-artifacts

Защитные артефакты Elastic Security предотвращает программы-вымогатели и вредоносное ПО, обнаруживает сложные угрозы и предоставляет реагирующим специалистам важный контекст. Это бесплатно и открыто, готово для каждой конечной точки. Protections-Artifacts — это дом нашей логики обнаружения правил...

SEP-14.2-Arbitrary-Write

Эксплойт CVE-2020-5837 Описание можно найти в блоге RedyOps Labs: https://labs.redyops.com/index.php/2020/04/27/symantec-endpoint-protection-sep-14-2-eop-via-arbitrary-write/ Инструменты сторонних разработчиков Этот код эксплойта основан на symboliclink-testing-tools, разработанных Джеймсом Форшо...

umap

umap - the USB host security assessment tool Based on Facedancer by Travis Goodspeed: http://goodfet.sourceforge.net/hardware/facedancer21/ Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Andy Davis, andy dot davis at nccgroup dot com...

SEPM-EoP

Краткое описание Название продукта : Symantec Endpoint Protection Manager версии 14 14 MP1 .2 build 1023 14.2.1023.0100 - более старые версии также могут быть затронуты Влияние : Высокое. Обычный пользователь Windows не администратор может повысить привилегии до NT SERVICE\semwebsrv . С этой роль...

cve-2019-12750

Symantec: локальное повышение привилегий - CVE-2019-12750 Основано на отличном обзоре от Kyriakos Economou: https://labs.nettitude.com/blog/cve-2019-12750-symantec-endpoint-protection-local-privilege-escalation-part-1/ На данный момент поддерживаются только x64 и старые версии Windows...

CVE-2017-16245

CVE-2017-16245 Исходный код для CVE-2017-16245 обход Avecto Defendpoint, первоначально раскрытый Nettitude Реализацию CVE-2017-16245 на PowerShell можно и нужно скопировать и вставить прямо в PowerShell. Если PowerShell заблокирован, попробуйте выполнить powershell.exe из командной строки. Для...

CVE-2022-37017

CVE-2022-37017 Symantec Endpoint Protection 14.3.5351 클라이언트 사용자 인터페이스 비밀번호 인증 우회 Symantec Endpoint Protection은 UI에 비밀번호 보호 기능을 설정하여 구성 변경을 방지할 수 있습니다. 이 비밀번호 확인은 PPLProtected Process Light이나 커널 드라이버에 있지 않은 로직으로 구현되어 있습니다. 메모리의 반환 값을 변경하거나 바이너리를 패치하면 공격자가 비밀번호를 우회할 수 있습니다. 이 방법은 Tamper Protection이...

CVE-2026-74983

Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2025-60357

AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint...

CVE-2025-60357

AhnLab EPP Management v1.0.14.32-6249 is affected by a NoSQL (MongoDB) injection in the endpoint /api/console/ems/eventlog/agentEvent/list, disclosed as CVE-2025-60357. The root cause is injectable MongoDB queries allowing disclosure of sensitive information/PII via the eventlog/agentEvent/list i...

CVE-2026-11626 Local Privilege Escalation in Symantec Endpoint Protection macOS CleanWipe Removal Tool

CleanWipe Removal Tool macOS, prior to 16.0.0.65, may be susceptible to an Local Privilege Escalation vulnerability, which is a type of issue whereby an attacker with limited privilege access on an affected system can escalate their privileges to gain administrative control...

CVE-2026-11626 Local Privilege Escalation in Symantec Endpoint Protection macOS CleanWipe Removal Tool

CleanWipe Removal Tool macOS, prior to 16.0.0.65, may be susceptible to an Local Privilege Escalation vulnerability, which is a type of issue whereby an attacker with limited privilege access on an affected system can escalate their privileges to gain administrative control...

Malwarebytes EDR 数字错误漏洞

Malwarebytes EDR is a terminal detection and response platform provided by the American company Malwarebytes. Version 1.0.11 of Malwarebytes EDR contains a vulnerability related to input validation. This vulnerability arises from truncating data exceeding 4GB during computing hash calculations,...

CVE-2026-34927

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability...

CVE-2026-45207

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-45206 but exists in a different process protection communication mechanism. Please note: an attacker must first obtain the abilit...

Microsoft is named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection

As threats become more coordinated and faster to execute, endpoint protection has become the proving ground for modern defense. For the seventh consecutive time, Microsoft has been named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. We believe this reflects both the...

Microsoft is named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection

As threats become more coordinated and faster to execute, endpoint protection has become the proving ground for modern defense. For the seventh consecutive time, Microsoft has been named a Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. We believe this reflects both the...

CVE-2026-34927

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability...

CVE-2026-45207

Technical details about CVE-2026-45207 are not publicly available in the provided documents. No specifics on affected components, root cause, impact, or fixes are included. Monitor for updates from vendors and authorities.

EUVD-2026-31286

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations. This is similar to CVE-2026-34927 but exists in a different named pipe communication mechanism. Please note: an attacker must first obtain the ability to...